/**
 * MemoryServiceContainerController — lifecycle for olam-memory-service.
 *
 * Mirrors KgServiceContainerController (./kg-service-container.ts). memory-service,
 * like kg-service, runs as a host-side Docker peripheral managed by `olam services up`.
 * The Phase A predecessor (host-process model — `olam memory start` spawning the
 * npm-installed `agentmemory` bin) is retired in Phase B; both substrates coexist
 * during Phase A so operators can roll back without losing data
 * (`~/.olam/memory-data/` is bind-mounted and survives substrate swap).
 *
 * Divergence from kg-service:
 *   - Bearer-authenticated livez probe (kg-service `/health` is unauthenticated).
 *     `waitForReady` reads `~/.olam/memory-secret` and adds `Authorization: Bearer <secret>`.
 *   - No /host-home read-only mount (kg-service mounts $HOME for build ingestion;
 *     memory-service writes only to its own /data volume).
 *   - No prewarm probe (kg-service pre-warms bge-small inference; memory-service has
 *     no equivalent hot path — iii engine init happens at process start, not first request).
 *
 * Plan reference: docs/plans/memory-service-as-docker-peripheral/phase-a-tasks.md A1
 */
export declare const MEMORY_SERVICE_PORT = 3111;
export declare const MEMORY_SERVICE_CONTAINER = "olam-memory-service";
export declare const MEMORY_SERVICE_LOCAL_TAG = "olam-memory-service:local";
export declare const MEMORY_SERVICE_PUBLISHED_TAG = "ghcr.io/pleri/olam-memory-service:latest";
export declare const MEMORY_SERVICE_DEV_TAG = "olam-memory-service:dev";
export declare const MEMORY_SERVICE_HEALTH_URL = "http://127.0.0.1:3111/agentmemory/livez";
export declare const MEMORY_SERVICE_HEALTH_TIMEOUT_MS = 60000;
type ContainerState = 'running' | 'stopped' | 'missing';
export interface MemoryServiceStatus {
    readonly state: ContainerState;
    readonly port: number;
    readonly containerId?: string;
    readonly ready?: boolean;
}
export declare class MemoryServiceContainerController {
    private imageTag;
    status(): MemoryServiceStatus;
    private imageExists;
    /**
     * Resolve the first available image tag: local → dev → published.
     *
     * The preferred path is :local (populated by `olam bootstrap` pulling the
     * digest-pinned image and tagging it). The :published fallback is `:latest`
     * which is NOT digest-pinned — Docker will pull whatever tag-head is on
     * the registry at pull time. This is the degraded-mode path for operators
     * whose image-digests.json predates the G1 memory-service digest fix; it
     * is intentionally loud so they know they are not on the pinned path.
     *
     * Throws if none exist (operator should run `olam bootstrap` to pull, or
     * `node packages/cli/scripts/build-memory-service-image.mjs` to build locally).
     */
    private resolveImage;
    /**
     * Idempotent start. If already running → return. If stopped → docker start.
     * If missing → ensure secret + bind-mount dir, then docker run with port-forward
     * + memory-data volume mount + restart policy + bearer-secret env.
     *
     * The bearer secret is read from `~/.olam/memory-secret` (generated on first
     * call via `ensureMemorySecret()`) and passed as `AGENTMEMORY_SECRET`. The
     * container's agentmemory CLI requires this for the livez probe + all API
     * calls; without it the container will start but reject every request as 401.
     */
    start(): void;
    /**
     * Returns true when no memory-service image exists locally — useful for
     * callers (e.g. servicesUp) to distinguish "operator opted out of
     * memory-service" from "memory-service was supposed to work but is broken".
     * The opted-out case should be silent; the broken case should warn.
     */
    imageMissingEverywhere(): boolean;
    stop(): void;
    remove(): void;
    /**
     * Poll /agentmemory/livez until 200 OK with `{status: "ok"}` body OR
     * timeoutMs elapses. The probe is bearer-authenticated; without the secret
     * header agentmemory returns 401 regardless of container state.
     *
     * Divergence from kg-service: kg-service's `/health` is unauthenticated and
     * returns `{ready: true}` once bge-small is loaded. memory-service's
     * `/agentmemory/livez` returns `{status: "ok"}` once iii-engine accepts
     * connections — there's no equivalent "model warmed" state to wait for.
     */
    waitForReady(timeoutMs?: number): Promise<boolean>;
}
export {};
//# sourceMappingURL=memory-service-container.d.ts.map